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The Federal Trade Commission is ramping up its enforce- 
ment of so-called dark patterns, with $350 million in set- 
tlements announced in late 2022. Many businesses may 
be uncertain what dark patterns are, or may think they do 
not need to worry. This Article argues that the FTC’s en- 
forcement practices are industry-agnostic and derived from 
previous enforcement actions over the last decade. By ex- 
amining these current and past enforcement actions, it is 
possible to develop a set of best practices around robust 
user notice and choice and user interface designs that do 
not present unnecessary hurdles to consumers. 


Scan to Stay Connected! 


Scan here to subscribe to CPI’s 
FREE daily newsletter. 


© 2023 Competition Policy International® All Rights Reserved 


In late 2022, the Federal Trade Commission (“FTC”) an- 
nounced settlements with two different businesses over the 
use of so-called “dark patterns.” Defining dark patterns is 
complicated; the FTC’s definition (“design practices that 
trick or manipulate users into making choices they would 
not otherwise have made and that may cause harm”) does 
not provide much enlightenment.? But using dark patterns 
can be costly: the first settlement in 2022 was a $100 mil- 
lion settlement with Vonage Holdings, a cloud communica- 
tions provider. The second was a $245 million settlement 
with Epic Games, Inc., maker of the popular video game 
Fortnite.* While these two enforcement actions represented 
the first time the FTC specifically named dark patterns in a 
complaint, they were not harbingers of an unexpected sea 
change. In 2021, the FTC held a workshop on “Bringing Dark 
Patterns to Light,” signaling an interest in dark patterns." 
The complaints against both Vonage and Epic are also not 
treading new ground; while the FTC names dark patterns in 
both complaints, the foundations of the FTC’s arguments 
can be found in other, older enforcement actions. 


The FTC is not the only enforcement agency eyeing dark pat- 
terns. Eighteen state attorneys general wrote to the FTC in 
August 2022, urging more action be taken on dark patterns.® 
The State of California, with its expansive California Privacy 
Rights Act (“CPRA”), outlaws the use of dark patterns when 
obtaining consumer consent for the collection of personal in- 
formation.’ Colorado, in the Colorado Privacy Act (“CPA”), 
and Connecticut, in the Connecticut Data Privacy Act (“CT- 
DPA”) do as well.? With $345 million in settlement payments 
(and counting), every business that interacts with consumers 
ought to be aware of dark patterns and how to avoid them. 

One hurdle businesses face, beyond assessing their con- 


sumer-facing communications and interactions, is defining 
what dark patterns are. The FTC’s definition asks more ques- 
tions than it answers. The CPRA is likewise not forthcoming 
(“a user interface designed or manipulated with the substan- 
tial effect of subverting or impairing user autonomy, decision- 
making, or choice, as further defined by regulation”).? The 
definitions found in the California Privacy Protection Agen- 
cy’s proposed regulations can only define dark patterns by 
what they are not.'® Colorado’s definition largely mirror’s the 
FTC’s."' Connecticut, meanwhile, just defers to the FTC." 


Companies across a diverse array of industries are scram- 
bling to ensure compliance with vague directives in state 
law and in federal regulations. Without much guidance, it 
almost seems easier for legal teams to shrug their shoul- 
ders. But it is possible to discern patterns in previous FTC 
enforcement actions that can guide businesses as they 
carefully scrutinize their interactions with consumers. The 
FTC’s dark patterns jurisprudence (if it can be called that) is 
not only identifiable but is easy to distill. This Article gives 
a brief overview of the FTC’s enforcement actions against 
both Vonage and Epic Games, and then examines previous 
enforcement actions dating back to the mid-2010s to de- 
velop a set of recommended best practices that are agnos- 
tic to industry and business model and focus on straightfor- 
ward interactions with consumers online. 


2 Feb. TRADE Comm'n, BRINGING DARK PATTERNS TO LIGHT (Sept. 2022) at 2. 
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7 See CAL. Civ. Cove § 1798.140(h) (2023) (“[A]greement obtained through the use of dark patterns does not constitute consent.”). 

8 See Cot. Rev. Stat. § 6-1-1303(5)(c) (2023); Conn. GEN. STAT. § 42-515(6)(C) (2023). 
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ANALYZING VONAGE AND 
EPIC GAMES 


For a company that serves digital ads on online publica- 
tions, or a company that makes a weather app, it can seem 
unintuitive to look at enforcement actions against a cloud 
telecommunications provider or a video game designer 
and see how it applies to your business. While Vonage and 
Epic Games are dramatically different companies, the prac- 
tices at issue are common in any business that interacts 
with consumers. Both companies struggled with presenting 
consumer choice, and both companies did not mirror their 
enrollment and cancellation processes. By examining the 
FTC’s complaints in Vonage and in Epic Games, it becomes 
apparent that the throughlines in the FTC’s enforcement are 
not industry-specific and can, in fact, serve as a touchstone 
for any business that interacts with consumers. 


A. Analyzing Vonage 


Vonage markets Voice over Internet Protocol (“VoIP”) phone 
services products to residential and business consumers. 
Prices for Vonage’s service range from $4.99 to over $50 
a month. Vonage offers a variety of enrollment methods, 
including a 24/7 website or through a toll-free telephone 
number.'* However, the cancellation process is more diffi- 
cult to navigate than the enrollment process. Between 2017 
and 2022, Vonage only allowed customers to cancel their 
enrollment by speaking with a live “retention” agent over the 
phone.'® Vonage did not present this requirement to con- 
sumers when they enrolled in Vonage’s services; rather, it 
was buried in a lengthy terms of service document.'® Even 
finding the telephone number for reaching the retention 
agents was a hurdle for consumers; while Vonage promi- 


nently displayed its main customer service telephone num- 
ber on its website, the special cancellation number was not 
presented to consumers in an immediately obvious man- 
ner.'” 


For customers whose plans were billed at less than $60 a 
month, the cancellation process was even more obtuse: 
first, they had to request a cancellation via online chat 
and wait to be connected with a live chat agent; then, the 
live chat agent would have to transfer their call to a live 
retention agent, requiring an additional wait.'® Additionally, 
Vonage put in place “Early Termination Fees” for custom- 
ers who wanted to cancel before the end of their contract 
period—but did not conspicuously disclose these terms.'? 
Vonage presented the disclosure in a small, unbolded font 
against a gray background, in contrast to the bolded, larger 
font disclosing the benefits of signing up for Vonage.*° For 
customers signing up over the phone, Vonage instructed its 
employees to not “proactively” offer information about the 
Early Termination Fees.” 


There are two key things to note about Vonage’s business 
practices that resulted in the FTC action. First, their con- 
sumer choice presentations were not accurate. Material 
information was obscured in such a way that only a par- 
ticularly vigilant consumer would be aware of it. The aver- 
age consumer would not find an accurate disclosure for the 
service they were signing up for. Likewise, the “consumer 
journey” (the process a consumer takes to consent to enroll 
in a service, and the process taken to revoke that consent) 
to cancel their Vonage account was circuitous and frustrat- 
ing, designed more to ensure customers continued to pay 
for a Vonage account instead of allowing them to cancel 
their membership at their will. 


Vonage eventually agreed to a $100 million settlement with 
the FTC.”? While Vonage is a cloud telecommunications 
service and Epic Games is a video game designer, many 
of the problems Vonage encountered were similar to the 


13 See Compl., Fed. Trade Comm’n v. Vonage Holdings Corp., Case No. 3:22-cv-6435, ECF No. 1 (D.N.J. Nov. 3, 2022). 
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practices the FTC would cite in its complaint against Epic 
Games. 


B. Analyzing Epic Games 


Epic Games develops and distributes the video game Fort- 
nite. Part of Fortnite’s appeal is that it is free to download 
and play, although like many games it offers certain in-game 
benefits that must be purchased with actual money. Fortnite 
is incredibly popular, with over 400 million players world- 
wide.” For in-game purchases, Epic would save consum- 
ers’ payment information by default and use it to bill con- 
sumers for future charges.”4 Despite this, Epic prominently 
advertises Fortnite as free; if a consumer were to down- 
load Fortnite on a personal computer, they would only find 
a small disclosure stating “In-Game Purchases” at the very 
bottom of the download page.” 


Once Epic had saved a consumer’s credit card informa- 
tion, players — many of them children and teenagers — could 
make in-app purchases “simply by pressing buttons with 
no parental or card holder action or consent.” There were 
no safeguards to prevent children from making purchases 
without parental consent — much to the surprise of parents 
reviewing their credit card bills.2” Epic knew this, and inter- 
nal documentation noted that “Unrecognized and Fraudu- 
lent Charges” was among the top five reasons customers 
complained to Epic Games.”8 In response to these com- 
plaints, Epic gave consumers the option not to have their 
credit card information saved — but only in a small checkbox 
in the checkout page, with a small print notice to “[m]ake 
this a one-time payment.””? Indeed, Epic never informed 
consumers that the default option was to automatically bill 
saved credit card information, and it was aware consumers 
typically did not check the small checkbox.*° 


The in-game purchase flow for Fortnite was also designed 
in such a way that it was easy for consumers (particularly 
children) to make accidental or unwanted purchases. For 
example, in the “Cosmetics” store (where players could 
preview popular costume changes for their in-game ava- 
tars), Epic would automatically charge consumers if they 
pressed a certain button, without requiring any further ac- 
tion from consumers, such as asking them to confirm their 
purchase.*' In contrast, players wishing to cancel an un- 
wanted purchase had to press and hold the button in addi- 
tion to confirming their request for a refund.*? 


66... develops and distributes the video 


game Fortnite 


Epic did not even offer an option to cancel certain charges 
until June 2019. Initially, the “Undo” option was present- 
ed in a visually identical manner as the purchase option.’ 
However, Epic soon reduced its prominence, changing its 
name to “Cancel Purchase,” reducing its size, moving it to 
the bottom of the screen (away from the “Purchase” but- 
ton), and requiring consumers to push and hold a button to 
cancel.*4 Once these changes were made, Epic “observed a 
roughly 35% decline” in the number of consumers undoing 
their purchases.*° 


Even requesting refunds was a convoluted process com- 
pared to the simple purchase procedures. To find the link 
to request a refund, consumers had to go to a “Settings” 


23 See Natasha Singer, Epic Games to Pay $520 Million Over Children’s Privacy and Trickery Charges, N.Y. Times (Dec. 19, 2022), https:// 
www.nytimes.com/2022/1 2/1 9/business/ftc-epic-games-settlement.html. 
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35 Id. at 11. 


tab on the Fortnite app menu, “far removed from the pur- 
chase screen,” despite the fact that requesting a refund is 
not a game or device setting.*° The designer even admitted 
that he put the link there in an “attempt to obfuscate the 
existence of the feature” and “add[ing] friction for friction’s 
sake.”°” 


Epic deliberately advertised its product as free, and then 
concealed the nature of its in-game purchase policies. It 
made the purchase process frictionless but went out of its 
way to make the refund process cumbersome. By hiding 
the nature of its in-game purchase policies, Epic tricked 
consumers into making choices they might not have other- 
wise made by saving their credit cards. By making its refund 
process burdensome-with the stated goal of curtailing user 
refund requests-it was preventing consumers from revok- 
ing their consent. Epic Games wound up settling with the 
FTC for $245 million.*® Epic was aware that its policies were 
hindering consumer choice, but rather than addressing 
these consumer hurdles, they doubled down and wound up 
paying a substantial fine for it. 
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DEVELOPING BEST PRACTICES 


By analyzing Vonage and Epic Games, certain commonali- 
ties in enforcement emerge, allowing us to begin to define 
what a dark pattern is. The way material information is pre- 
sented — or hidden — is relevant in the FTC’s analysis. Like- 
wise, the consumer journey — the process a consumer takes 
to consent to enroll in a service, and the process taken to 
revoke that consent — is closely scrutinized. To borrow a 
phrase from the Epic Games engineer, “friction for friction’s 
sake” is highly suspect. These general best practices were 


36 la. 


37 ld. 


derived from an analysis of enforcement actions the FTC 
has taken over the last decade, up to and including Vonage 
and Epic Games. They can be divided into two categories: 
Considerations for Robust User Notice and Choice, and 
Considerations for User Interface Design. 


A. Considerations for Robust User Notice and Choice 


When determining how to present consumers with notice 
and choice, the three topline concerns for any business 
looking to avoid dark patterns should be accurate dis- 
closures, seamless revocation processes, and the use of 
straightforward language. 


1. Accuracy 


In order for a disclosure to be accurate, all material terms 
and conditions should be included when obtaining con- 
sumer consent. Terms and conditions should be stated in 
an easy to understand way that is unlikely to deceive con- 
sumers.°? In particular, a business should avoid employing 
“negative options,” provisions “under which the customer’s 
silence or failure to take affirmative action to reject goods 
or services or to cancel the agreement is interpreted” as 
consent.*° Businesses should also avoid telling consumers 
their data is needed for a service to operate when in actual- 
ity itis not.“ 


The FTC has been clear about this need for accuracy for 
many years. For example, in 2015, the FTC brought an ac- 
tion against PaymentsMD, LLC, a medical billing provider, 
alleging the company failed to inform consumers that it 
would be collecting sensitive health information from third 
parties.” In 2018, the FTC sued PayPal, Inc., over disclo- 
sures in its mobile payment app Venmo.** The FTC alleged 
that PayPal failed to provide conspicuous disclosures of 
material terms to consumers when first signing up for the 
app, in violation of the Gramm-Leach-Bliley Act and subse- 
quent FTC regulations.“ And in 2019, the FTC sued Office 
Depot, Inc., in a case alleging that a service Office Depot 
advertised as a free PC checkup program was actually a 


38 Press Release, Federal Trade Commission, Fortnite Video Game Maker Epic Games to Pay More Than Half a Billion Dollars over FTC 
Allegations of Privacy Violations and Unwanted Charges (Dec. 19, 2022) (https://www.ftc.gov/news-events/news/press-releases/2022/1 2/ 
fortnite-video-game-maker-epic-games-pay-more-half-billion-dollars-over-ftc-allegations). 


39 See, e.g. In re PayPal, Inc., F.T.C. File No. 162 3102 (May 23, 2018); In re PaymentsMD, LLC, F.T.C. File No. 132 3088 (Jan. 27, 2015). 


40 Telemarketing Sales Rule, 16 C.F.R. § 310.2(w) (2023). 


41 See Compl., Fed. Trade Comm'n v. Office Depot, Inc., No. 9:19-cv-80431, ECF No. 1 (S.D. Fla. Mar. 27, 2019). 


42 See PaymentsMD, LLC, F.T.C. File No. 132 3088 at 2. 
43 See PayPal, Inc., F.T.C. File No. 162 3102 at 11. 
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tool to sell diagnostic and repair services to unsuspecting 
consumers.*° 


The subversion of consumer choice in these examples is 
plain. When a consumer is not given all the material infor- 
mation, they need to make a decision — whether it is a deci- 
sion to opt out of tailored advertising, to download an app, 
or to sign up for a service-the consumer’s consent is not 
informed. When disclosures are not conspicuous, or hid- 
den away on other parts of a platform, an unknowing con- 
sumer could reasonably determine they have been given 
all the material information they need to make a decision. 
Likewise, when a disclosure is dishonest about what a con- 
sumer needs to know, especially when there is a cost (mon- 
etary or otherwise) the consumer must pay when they make 
their decision, it could influence the consumer’s choice in 
an unlawful way. 


2. Seamless Revocation 


The revocation of consent can take several forms, includ- 
ing canceling a purchase, unsubscribing, or opting out. The 
revocation process should be seamless; that is, it should 
be easy for a consumer to do while also providing the con- 
sumer with complete information about the revocation pro- 
cess.“ The number of steps in the “consumer journey” to 
revoke consent (i.e. the discrete actions a consumer must 
take) should be equal to the consumer journey to sign up 
for a service.*” 


Providing all material information is critical. In 2016, the FTC 
reached a settlement with NutraClick, a company that sold 
nutritional supplements and beauty products, over its can- 
cellation practices.*® NutraClick enrolled consumers into a 
recurring monthly program when they ordered a “free trial” 
of NutraClick’s products, and failed to disclose the enroll- 
ment.*° After settling with the FTC, NutraClick continued to 
employ dark patterns in its business practices by failing to 
conspicuously disclose that consumers must cancel their 
free trial at least one day before the end of the trial period, or 
else they would be automatically charged for enrollment.°° 


45 See Compl., Office Depot, No. 9:19-cv-80431, at 2. 


CL vocation of consent can take several 


forms, including canceling a purchase, unsub- 
scribing, or opting out 


In 2020, the FTC sued Age of Learning, Inc., which operated 
the online children’s education platform ABCmouse.com. 
On the signup page for ABCmouse.com, Age of Learn- 
ing represented that it had “Easy Cancellation” (in bold, 
red text) promising that consumers could “cancel at any 
time.”>' Enrollment in ABCmouse.com could be done on 
one page with a single form.® Cancellation, however, was 
a more circuitous process. Consumers could not cancel by 
telephone, email, or by web form, like they could for sign- 
ing up. Instead, they had to go through four separate pages 
of ABCmouse.com for a link labeled “Cancellation Policy,” 
which in actuality was the cancellation mechanism.” 


By making the revocation process onerous, the offending 
companies were effectively trapping consumers into con- 
tinuing to pay for services they did not want to receive. The 
longer the consumer journey was, the less likely consumers 
were to actually revoke their consent. Even before the en- 
actment of laws specifically prohibiting the use of dark pat- 
terns, the FTC was able to enforce against these practices 
with its authority under the FTC Act. 


3. Straightforward Language 


Notice presented to a consumer should be as clear and 
straightforward as possible. As a matter of California law, 
businesses cannot use double negatives (e.g. “Don’t not sell 
my personal information”), nor can they require consumers 
to click through or listen to a list of reasons for why they 
should not revoke their consent. In the Age of Learning en- 
forcement matter, the FTC noted that ABCmouse.com also 
required consumers to scroll through a list of reasons why 


46 See Compl., Fed. Trade Comm'n v. NutraClick, LLC, No. 2:20-cv-08612, ECF No. 1 (C.D. Cal. Sept. 21, 2020) (NutraClick Il). 


47 See Compl., Fed. Trade Comm'n v. Age of Learning, Inc., No. 2:20-cv-7996, ECF No. 1 (C.D. Cal. Sept. 1, 2020). 


48 See Compl., Fed. Trade Comm'n v. NutraClick, LLC, No. 2:16-cv-06819, ECF No. 1 (C.D. Cal. Sept. 12, 2016) (NutraClick |). 
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51 Compl., Fed. Trade Comm'n v. Age of Learning, Inc., No. 2:20-cv-7996, ECF No. 1 (C.D. Cal. Sept. 1, 2020). 


52 ld. at 6. 
53 /d. at 11. 


54 Cat. Cope Ress. tit. 11, § 999.315(h)(2)-(3) (2023). 


they should not cancel their membership, including a list of 
ways to “upgrade” their membership.® While businesses 
have a First Amendment right to inform consumers about 
the products they offer or the services they provide, it is im- 
portant to deploy neutral language that does not pressure 
consumers into making a particular choice. 


For companies that rely on technologies such as cookies to 
remember user settings, these settings can be reset when 
a consumer clears their cookies or they expire, or they are 
browsing on anew, unrecognized device or from a different 
IP address. In these instances, companies should be aware 
of this situation and should notify consumers and provide 
them with the opportunity to reestablish their privacy set- 
tings. 


By using straightforward, concise language, a business in- 
teracting with a consumer can ensure that it has provided 
all material information necessary for a consumer to make 
an informed choice. 


B. Considerations for User Interface Designs 


In designing the user interfaces for consumer choice mech- 
anisms, many of the considerations that businesses must 
take in presenting consumer choice are present. Business- 
es should avoid using unnecessarily confusing language, 
and they should avoid an overly long consumer journey. 
They should also ensure that in consumer interactions ac- 
tually present a choice and do not infer one; for example, 
in a banner notifying consumer that a website uses cookies 
to collect information for personalized advertisements, the 
banner should have an “Accept” and “Deny” button as op- 
posed to just an “Accept” button, or indeed, no button at 
all, just a means of closing the banner. 


In 2019, the FTC brought an action against AH Media Group, 
a company that sold personal care and dietary supplements 
online. In its complaint against AH Media, the FTC noted AH 
Media’s relevant terms and conditions for free trial offers 
were often obscured on their websites, using small, hard to 
read fonts that blended in with the background color of the 
website.®® 


When presenting any notice to consumers, businesses 
should ensure that the text is legible on both desktop and 
mobile devices, and that instructions for revoking con- 
sent are not hidden in a place consumers would not think 
to look. If the goal is to avoid dark patterns, the business 
should state all material terms in a single, easy to find loca- 
tion, displayed in a visually neutral manner. 


55 See Compl., Age of Learning, Inc., No. 2:20-cv-7996 at 14. 
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CONCLUSION 


The practices the FTC cited in its complaint against Epic 
Games are nearly identical to the practices the FTC cited in 
its complaint against Vonage. They are practicing the FTC 
has cited in complaints against a variety of businesses over 
the last decade, practices that cut across industry. They 
are practices that any business that interacts with consum- 
ers — whether it’s an ad tech company collecting consumer 
data online or the manufacturer of personal hygiene prod- 
ucts marketing a monthly subscription service — must bear 
in mind. 


The FTC has begun to name dark patterns for what they 
are, but in many ways this is just giving old enforcement 
practices a rebrand. By specifically calling these practices 
dark patterns, the FTC is making its priorities plain. As the 
FTC continues to enforce against dark patterns, buttressed 
by state attorneys general with specific authority over the 
use of dark patterns, companies should ensure their inter- 
actions with consumers and the design choices they make 
are straightforward and neutral. E 


6 Lovin the user interfaces for consumer 


choice mechanisms, many of the consider- 
ations that businesses must take in presenting 
consumer choice are present 


56 See First Am. Compl., Fed. Trade Comm’n v. AH Media Group, LLC, No. 19-cv-04022-JD, ECF No. 74 (N.D. Cal. Oct. 23, 2019) at 14. 


CPI 
SUBSCRIPTIONS 


CPI reaches more than 35,000 readers in over 150 Visit today 
countries every day. Our online library houses over to see our available plans and join CPIs global 
23,000 papers, articles and interviews. community of antitrust experts. 


COMPETITION POLICY® 


© 2023 Competition Policy International® All Rights Reserved DTERNATIONAL 


